An AI found a $500k WordPress exploit in 10 hours for $25 — and that's the least worrying part

A security researcher recently gave an advanced AI model the WordPress source code and asked it to find a path from an unauthenticated request to remote code execution. A little over 10 hours later, it had assembled an exploit chain against a default installation of one of the most widely used content management systems on the web. The model usage cost about $25, while exploit brokers have advertised payouts of up to $500,000 for a comparable WordPress vulnerability. The unsettling part isn’t just that an AI model found a serious bug. It’s that it handled a large chunk of the slow, highly specialized work that used to keep this kind of research out of reach for almost everyone. This was far more than automated vulnerability scanning The model had to build an unusually complex attack Security researcher Adam Kues didn’t point a scanner at a WordPress site and wait for a red warning icon. He downloaded the current WordPress source code, removed its Git history, and told the model to work from the code instead of looking up known patches or vulnerability reports. He also required a pre-authentication attack that worked against a fairly normal production setup using MySQL. That ruled out a lot of easy answers, including flaws that only mattered after login or under unusual database configurations. The first major discovery involved the WordPress batch API. Separate arrays tracked matched request handlers and their validation results, and those arrays could be pushed out of alignment by inserting a malformed request. That meant one request could end up being checked against the validation rules for a different endpoint. It sounds small when reduced to one sentence, but the practical result was a sanitization bypass that let unsafe input travel farther than WordPress intended. The model then connected that behavior to another input-handling mistake that allowed an unsanitized value to reach a SQL query. There was still a problem, though. The vulnerable database path was normally reached through a GET request, while the batch API rejected GET requests. The model worked around that by nesting one batch request inside another and using the validation mismatch twice, eventually producing a pre-authentication SQL injection that could read arbitrary database values. Turning database access into code execution was harder Several obscure WordPress behaviors had to work together A SQL injection is already a serious result, but this one initially provided read access rather than a clean route to full control. That matters because reading WordPress data doesn’t automatically hand an attacker a working administrator account. Passwords are stored as hashes, and a strong administrator password may not be practical to crack. The model had to keep going and find another way to turn database reads into administrative access. This is where the chain became much harder to follow. The SQL injection could fabricate post records returned from the database and place them into WordPress’s temporary in-memory post cache. The model then used WordPress’s embed behavior to turn some of those temporary objects into persistent database records. By creating a mismatch between a cached post and the version stored in the database, the exploit could influence how WordPress reconciled and updated the two. From there, the model linked together theme customization changesets, post-parent cycle correction, and WordPress’s dynamic hook system. The exploit temporarily caused WordPress to operate using the authority of the primary administrator, then used the parse_request hook to replay the original batch request while those privileges were still active. A request to create a new administrator failed on its first pass because it ran as a guest, then succeeded when replayed inside that privileged window. Once that account existed, the attacker could log in, upload a backdoor plugin, and run code on the server. The experiment still depended heavily on human expertise This was not a one-click hacking demonstration Source: Anete Lusina (Pexels) It would be easy to flatten this into a cleaner story than it really was: an AI model looked at WordPress, found a zero-day, and printed out a working exploit. That isn’t what happened. Kues wrote a detailed prompt, adapted ideas from an existing research prompt, supplied the source tree, imposed constraints, and directed several agents to explore different parts of the problem for at least six hours. The model did a lot of work, but it wasn’t dropped into an empty chat box with a vague request to “hack WordPress.” AI can make discovery cheaper without making any of the defensive steps easier. The result also needed careful human verification. Kues reproduced the SQL injection against a remote WordPress installation, confirmed that it could retrieve the administrator email used during setup, and then pushed the model to investigate ways to escalate further. He spent much of the following day untangling the final chain before reporting it. The SQL injection itself was relatively understandable, but he said the post-exploitation steps took him much longer to grasp than they took the model to generate fully. That gap matters. A less experienced person might have received the same output and had no reliable way to tell whether it was brilliant, broken, or merely plausible-looking. AI models still produce dead ends, invalid assumptions, and code that reads well without actually working. Kues built guardrails into the process to reduce those problems, including adversarial checking and instructions designed to stop every agent from chasing the same promising idea. This wasn’t proof that anyone with $25 can reliably produce a half-million-dollar exploit in an afternoon. Those limitations do not make the result reassuring Attackers can repeat cheap experiments until one succeeds Credit: Source: Tima Miroshnichenko/Pexels The human expertise involved is real, but it’s not much of a comfort once the underlying labor becomes this cheap. An attacker doesn’t need every run to succeed when a long attempt costs about $25. They can point several runs at different applications, adjust the prompts, preserve useful intermediate findings, and throw away the failures. The expertise barrier remains, but the cost of supplying that expertise with hours of additional investigative work has dropped sharply. The reported $25 figure refers to the AI model usage for this specific research run. It doesn’t include the researcher’s time, security expertise, infrastructure, verification work, or the effort required to understand and responsibly disclose the exploit chain. The model also helped with one of the most difficult parts of exploit research: keeping track of enough disconnected behavior across a large codebase to build a complete chain. This exploit crossed API validation, SQL query construction, object caching, embeds, post reconciliation, customization changesets, hierarchy correction, dynamic hooks, and request dispatch. None of those pieces delivered remote code execution on its own. The result depended on noticing how they could be arranged in a very specific sequence. That’s the part I find harder to dismiss than the $25 figure by itself. Security researchers have always used automation, scripts, fuzzers, and static analysis tools, but this model wasn’t just flagging suspicious code. It was proposing ways to combine behaviors, testing those ideas, backing away from failed routes, and moving on. Responsible researchers can use the same capability to find vulnerabilities before criminals do, but the model doesn’t care who submitted the prompt or what they plan to do with the result. Cheap AI research could overwhelm defensive security teams Finding vulnerabilities may become faster than fixing them Credit: Source: Matheus Bertelli/Pexels Software vendors already struggle to process vulnerability reports, reproduce complicated bugs, build patches, test for regressions, and persuade users to install updates. AI can make discovery cheaper without making any of those defensive steps easier. A researcher might spend $25 and half a day finding a flaw, while the vendor spends days understanding the chain and weeks correcting it without breaking anything else. That imbalance gets ugly quickly if the number of serious reports starts rising. WordPress makes the risk easier to see because its core software sits beneath an enormous number of websites. A vulnerability in a default feature creates a large pool of possible targets before many administrators even know there’s a problem. Kues delayed publication to give users time to update, but other researchers were still able to reproduce the chain before public proof-of-concept code appeared. That’s useful for independent validation, but it also shows how quickly a guarded finding can become understood by more people. Defenders are going to need the same class of tools. Vendors may have to run continuous AI-assisted code audits, examine unusual combinations of otherwise ordinary behavior, and test fixes against attack paths a human reviewer might not think to try. They’ll also need better software inventories and faster ways to identify which systems are exposed after a disclosure. None of that is impossible, but it requires time, money, and people before AI-assisted vulnerability research becomes routine rather than after. The real warning is how quickly the economics changed This WordPress exploit doesn’t prove that AI can replace experienced security researchers. It shows that one experienced researcher can now direct far more investigative work than before, at a price low enough to repeat without much hesitation. The model reviewed code, proposed uncommon exploitation techniques, rejected failed paths, and connected distant parts of WordPress into a working attack chain. The human remained essential, but the amount of usable labor available to that human expanded dramatically. The expertise barrier remains, but the cost of supplying that expertise with hours of additional investigative work has dropped sharply. That can be a major advantage for software security when responsible researchers and vendors use it well. It also puts sophisticated offensive research within reach of smaller criminal groups, independent operators, and anyone willing to keep running inexpensive experiments against valuable targets. The $500,000 comparison is attention-grabbing, but the real issue is the gap between the value of the exploit and the cost of searching for it. When that search gets this cheap, defenders don’t get to keep working at the old pace. ChatGPT ChatGPT is one of the best LLMs out there, and it's completely free to use. You'll need to make an account, but there's not much else to it.